PHP2Shell Flaws Force Dozens of UK Government Services Offline as Countries Take Precautions

The PHP2Shell vulnerabilities have forced 32 UK government services offline and left four more partly unavailable, according to figures given to the House of Lords by tech minister Baroness Lloyd of Effra. She said the outages largely resulted from precautionary steps taken to protect systems while security updates and mitigations are applied. The Office for Budget Responsibility is among those known to have taken its website down, and peers also raised reports of disruption affecting the DVLA and police services. No full list of affected services has been published.

The problem is not limited to Britain. Government websites in Germany, France, Belgium, Finland and the Netherlands have also been taken offline as a precaution, along with the website of Australia's own cybersecurity agency. The US National Security Agency has urged organisations to patch or disconnect vulnerable systems, though the US government has not publicly confirmed any website shutdowns.

PHP2Shell covers two critical flaws, CVE-2026-109618 and CVE-2026-109619, which could let unauthenticated attackers run code on vulnerable servers. The UK's National Cyber Security Centre warned organisations to patch immediately or consider taking affected systems offline until they are fixed. Security firm Calif found one of the bugs using an OpenAI model, while Wiz separately uncovered both flaws with AI tools. OpenAI then investigated and worked with vendors and government agencies on coordinated disclosure.